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Attorneys for the United States 


UNITED STATES DISTRICT COURT 
DISTRICT OF OREGON 
EUGENE 


UNITED STATES OF AMERICA, 
Plaintiff, 


v. 


$2,457,790.72 in Funds seized from 
JPMorgan Chase Bank account #xxx0905; 
$1,266,650.00 in Funds seized from 
JPMorgan Chase Bank account #xxx3511; 
$1,383.68 in Funds seized from 
JPMorgan Chase Bank account #xxx2125; 
$200,653.71 in Funds seized from 
JPMorgan Chase Bank account #xxx8881; 
$32,921.00 US Currency; 

$1,940.77 US Currency; 

31.53810677 BTC; 

1,022.39066800 ETH; and 
5.74017141 BCH; 
in rent. 


6:19-cv-00707-BR 


COMPLAINT, in rent, 
FOR FORFEITURE 


Defendants. 


Plaintiff, United States of America, by Billy J. Williams, United States Attorney for the 
District of Oregon, and Amy E. Potter Assistant United States Attorney, for its complaint in rem 


for forfeiture, alleges: 
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I. 

This Court has subject matter jurisdiction, in rem jurisdiction, and venue pursuant to 
31 U.S.C. § 5324; 28 U.S.C. §§ 1345, 1355, 1356, and 1395; and 19 U.S.C. § 1610. 

II. 

Defendants, in rem, $2,457,790.72 in funds seized from JPMorgan Chase Bank account 
#xxx0905; $1,266,650.00 in funds seized from JPMorgan Chase Ba nk account #xxx3511; 
$1,383.68 in funds seized from JPMorgan Chase Bank account #xxx2125; $200,653.71 in funds 
seized from JPMorgan Chase Bank account #xxx8881; $32,921.00 US Currency; $1,940.77 US 
Currency; 31.53810677 BTC; 1,022.39066800 ETH; and 5.74017141 BCH (hereinafter 
“Assorted Funds”); were seized in the District of Oregon, and are now and during the pendency 
of this action will be within the jurisdiction of this Court. 

III. 

Defendants, in rem. Assorted Funds, represent proceeds traceable to a violation of 
18 U.S.C. § 2319 (Copyright Infringement), thereby subjecting them to forfeiture pursuant to 
18 U.S.C § 2323 and 18 U.S.C. § 981(a)(1)(C), as more particularly set forth in the declaration 
of Keith Druffel, Special Agent, Internal Revenue Service-Criminal Investigations, marked as 
Exhibit A, attached and fully incorporated herein by this reference. 

IV. 

Defendants, in rem, Assorted Funds, also represent property involved in a transaction in 
violation of 18 U.S.C. § 1957 (Money Laundering), thereby subjecting them to forfeiture 
pursuant to 18 U.S.C. § 981(a)(1)(A), as more particularly set forth in the declaration of Keith 
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Druffel, Special Agent, Internal Revenue Service-Criminal Investigations, marked as Exhibit A, 
attached and fully incorporated herein by this reference. 

WHEREFORE, plaintiff, United States of America, prays that due process issue to 
enforce the forfeiture of defendants, in rem, Assorted Funds; that due notice be given to all 
interested persons to appear and show cause why forfeiture of these defendants, in rem, should 
not be decreed; that due proceedings be had thereon; that these defendants be forfeited to the 
United States; that the plaintiff United States of America be awarded its costs and disbursements 
incurred in this action. 

Respectfully submitted this 6th day of May 2019. 

BILLY J. WILLIAMS 
United States Attorney 

s/ Amy E. Potter 

AMY E. POTTER 

Assistant United States Attorney 
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VERIFICATION 


I, KEITH DRUFFEL declare, under penalty of perjury, pursuant to the provisions of 
28 U.S.C. Section 1746, that I am a Special Agent with the Internal Revenue Service-Criminal 
Investigations and that the foregoing Complaint in rent for Forfeiture is made on the basis of 
information officially furnished and upon the basis of such information the Complaint in rem for 
Forfeiture is true as I verily believe. 


s/ Keith Druffel 
KEITH DRUFFEL 
Special Agent 

Internal Revenue Service-Criminal Investigations 
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DECLARATION of KEITH DRUFFEL 

I, KEITH DRUFFEL, do hereby declare: 

BACKGROUND/EXPERIENCE 

1.1 am a Special Agent of the Internal Revenue Service-Criminal Investigations (IRS-CI) 
assigned to the Eugene, Oregon Post of Duty, and have been so employed since 2007. As a 
Special Agent, I investigate possible violations of the Internal Revenue Code (Title 26 United 
States Code), the Money Laundering Control Act (Title 18 United States Code), the Ba nk 
Secrecy Act (Title 31 United States Code), and other criminal violations. 

PURPOSE OF DECLARATION 

2. This declaration is submitted in support of a complaint in rem seeking forfeiture of the 
funds in the following JP Morgan Chase Ba nk accounts as well as the currency and 
cryptocurrency 1 listed below: 

a. $2,457,790.72 seized from Chase Platinum Business Checking account ending in 

0905, in the name of Viral Sensations Inc. 

b. $1,266,650.00 seized from Chase Platinum Business Checking account ending in 

3511, in the name of Viral Sensations Inc. 


1 Cryptocurrency” (also known as “digital currency”) is generally defined as an 
electronically sourced unit of value that can be purchased with, sold for, or used as a substitute 
for fiat currency (i.e., currency created and regulated by a government). Bitcoin (“BTC”) is a 
type of cryptocurrency. Users store their cryptocurrencies in digital “wallets,” which are 
identified by unique electronic “public addresses.” A wallet essentially stores the access code 
that allows an individual to conduct cryptocurrency transactions. A cryptocurrency address is 
represented as a case-sensitive string of letters and numbers. Each cryptocurrency wallet contains 
a private key, which acts as a digital verification of ownership. Only the holder of the private key 
can authorize any transfers of digital currency. 
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c. $1,383.68 seized from Chase Platinum Business Checking account ending in 2125, 

in the name of Viral Sensations Inc. 

d. $200,653.71 seized from Chase Premier Platinum Checking account ending in 

8881, in the name of Talon V. White. 

e. $32,921.00 in US Currency seized during the execution of a search warrant at 

Talon White’s house. 

f. $1,940.77 in US Currency from the Stripe 2 account belonging to Talon White. 

g. 31.53810677 BTC (Bitcoin, a form of cryptocurrency) seized from Talon White’s 

Coinbase 3 account. 

h. 1,022.39066800 ETH (Ethereum, a form of cryptocurrency) seized from Talon 

White’s Coinbase account. 

i. 5.74017141 BCH (Bitcoin Cash, a fonn of cryptocurrency) seized from Talon 

White’s Coinbase account. 

These accounts, currency, and cryptocurrency represent proceeds traceable to violations 
of 18 U.S.C. § 2319 (Copyright Infringement), thereby subjecting them to forfeiture pursuant to 
18 U.S.C § 2323 and 18 U.S.C. § 981(a)(1)(C). 

3. In addition, because White used over $10,000 to purchase certain cryptocurrency, 
those accounts are property involved in transactions in violation of 18 U.S.C. § 1957 (Money 
Laundering), thereby subjecting them to forfeiture pursuant to 18 U.S.C. § 981(a)(1)(A). 


2 Stripe is a United States based technology company which allows both private 
individuals and businesses to accept payments over the internet, similar to PayPal 

3 Coinbase is a virtual currency exchange based in San Francisco, California. 
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4. Based on evidence obtained in this investigation, including White’s e-mails, 
declarations from the Motion Picture Association of America (hereinafter “MPAA”), federal tax 
return information, bank records, and property title records, there is probable cause to believe, 
and I do believe, that beginning in at least 2013 and continuing to the present, White engaged in 
a scheme with other known and u nkn own co-conspirators to reproduce and distribute 
copyrighted material, including motion pictures and television broadcasts, for the purpose of 
personal financial gain by making it available on a computer network accessible to members of 
the public by subscription. The subscription fees, which represent the proceeds of the copyright 
infringement, were processed through PayPal and Stripe accounts associated with White and 
then deposited into various bank accounts controlled by White. One particular bank account, a 
Wells Fargo account ending in 5111, received over $1,400,000.00 in criminal proceeds. Proceeds 
from these ha nk accounts were then used to purchase, among other things, cryptocurrency and 
real property. 

5. The information contained in this declaration is based on my personal knowledge, as 
well as information obtained from other law enforcement personnel and from my review of 
financial records. The information set forth here is provided solely for the purpose of 
establishing probable cause in support of the seizure and therefore, it does not include each and 
every fact that I or others have learned during the course of this investigation. 

SUMMARY OF THE INVESTIGATION 

6. In October 2013, Homeland Security Investigation (HSI) agents received information 
from PayPal regarding websites identified as www.noobroom.com and www.noobroom7.com 
that allowed subscribers to stream and download copyrighted movies and television shows. HSI 
agents contacted the MPAA regarding these websites, requesting they open an investigation to 
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determine if the websites were authorized by member studios to offer the copyrighted content to 
subscribers. The MPAA assists the motion picture and television industry to protect their 
intellectual property rights, including copyrights. Specifically, the MPAA monitors the illegal 
reproduction and distribution of American motion pictures and television programs. 

7. In November 2013, the MPAA provided a report of their investigation to HSI. 
According to the MPAA report, www.noobroom7.com and its associated websites 
www.noobroom5.com and www.noobroom9.com (hereinafter referred to collectively as 
“Noobroom”) were distributing, without authorization from the copyright holder, motion pictures 
and television shows that are protected by United States copyrights. The MPAA determined that 
many of the movies available on Noobroom were from member studios and that Noobroom was 
not authorized to allow the content to be downloaded or streamed. The MPAA reported that 
Noobroom generated revenue through the sale of subscriptions which allowed users to either 
stream or download copyrighted content. 

8. The MPAA reported that Noobroom not only received revenue from subscription 
payments from users of the websites, but also received revenue from advertisements placed on 
its webpages by a company identified as Lanista Concepts (hereinafter “LC”). The subscription 
payments were being processed through Stripe. 

9. On July 17, 2014, the MPAA sent an e-mail to noobdmitri@gmail.com and 
donutdmitri@gmail.com, two contact e-mails for Noobroom, directing them to cease and desist 
operating the illegal website. The content of the e-mail notified the operator of Noobroom that 
they were violating copyright laws and requested they take immediate steps to address the 
copyright infringement of MPAA Member Studios’ motion pictures and television programs. 
Attached to the letter was a list of motion pictures and television programs being used illicitly by 
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Noobroom that were owned or controlled by MPAA Member Studios. Approximately five days 
after the MPAA sent the cease and desist letter to Noobroom, the MPAA received an e-mail to 
its undercover subscription at Noobroom. The e-mail was from noreply@noobroom.com with 
the subject, “Noobroom Important Update.” The e-mail advised that user accounts had been 
moved to a new website, www.superchillin.com (hereinafter “Superchillin”). 

10. HSI agents were able to download movies from Superchillin and obtained IP address 
information while downloading those movies. With this information, they identified the 
company hosting the servers used by Superchillin as Hosting Services Inc. The account 
associated with the IP addresses was held in White’s name and included a phone number 
associated with White. 

11. Through additional investigative efforts, two more sites linked to White were 
identified — Movietv.to and Sit2play.com (Movietv and Sit2play). In June 2016, HSI agents 
attempted to login to Movietv and were redirected to Sit2play, which accepted the login 
information for Movietv. Sit2play appeared to be a near mirror image of Movietv in both content 
and appearance. In 2017, HSI Agents attempted to renew the subscription to Movietv and found 
the Movietv address had a notification posted that the site was moved to Sit2play. The registrant, 
technical, administrative, and billing contacts for Sit2play were listed as White, with company 
“NB” and e-mail address heyitstalon@hotmail.com, an email the investigation determined 
belonged to White. 

12. HSI agents downloaded content from Superchillin, Movietv, and Sit2play throughout 
2016 through November 2018 (when the search and seizure warrants were executed). The 
MPAA reported that the subject websites listed above were distributing, without authorization 
from the copyright holder, motion pictures and television shows that are protected by U.S. 
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Copyrights. The MPAA determined that many of the movies available on the subject websites 
were from member studios and that the subject websites were not authorized to allow the content 
to be downloaded or streamed. The MPAA reported that the subject websites generated revenue 
through the sale of subscriptions which allowed users to either stream or download copyrighted 
content. Also, the MPAA advised that the content downloaded by HSI contained copyrighted 
material and the MPAA provided certification as such. 

Financial Analysis 

13. Based on financial records obtained during the investigation, I determined that White 
received substantial revenue from the above-listed websites. In 2018, he was averaging revenue 
over $500,000 per month. In 2017, White received over $2.2 million. In 2016, White received 
over $1 million in revenue, and in 2014 and 2015, White received on average about $400,000 a 
year in revenue. 

14. Subscribers to the various websites run by White paid for their subscriptions via 
Paypal or Stripe. Those payments were then deposited into bank accounts controlled by White. A 
financial analysis was conducted of all of those accounts and confirmed that money in those 
accounts was received from Stripe or Paypal or other bank accounts that received those funds. 
For this reason and for the reasons that follow, I believe those funds constitute the proceeds of 
the copyright infringement. 

15. Stripe provided information related to White’s Stripe account that accepted 
subscription payments. The bank account, phone number, and email address provided matched 
White’s information. The product description for the account was listed as “Selling stock tip 
subscriptions via email.” I have found no evidence he was engaged in selling stock tips. 
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16. Investigators reviewed payments received into the Stripe account from October 5, 
2015 to December 25, 2016. There were 78,985 payments received in the amount of $9.99 for a 
total of $789,060.15; 7,611 payments received in the amount of $25.49 for a total of 
$194,004.39; and 5,348 payments received in the amount of $44.99 for a total of $240,606.52, 
for a grand total of $1,223,671.24. The above-listed amounts correspond to the listed 
subscription costs on Sit2Play and Movietv. Therefore, I believe the payments received by Stripe 
are the subscription fees for the websites. 

17. Payments into White’s Stripe account were also reviewed for the timeframe of 
October 1, 2016 to September 20, 2018 (a separate set of records that were received). There were 
302,905 payments in the amount of $9.99 totaling $3,026,020.95, 45,050 payments in the 
amount of $25.49 totaling $1,148,324.50, and 48,888 payments in the amount of $44.99 totaling 
$2,199,471.12. The total amount of the above listed payments into White’s Stripe account was 
$6,373,816.57. The above listed amounts correspond to the cost of subscriptions to the websites 
and represent proceeds from the violation of 18 USC § 2319, Criminal Copyright Infringement. 

18. Further review of White’s Stripe account showed that through August 2018, over $3 
million was transferred from the Stripe account to White’s Wells Fargo account 5111 and to the 
JP Morgan Chase Ba nk account 0905 in the name of Viral Sensations, Inc. 

19. Viral Sensations, Inc., (VSI) was incorporated in Nevada on March 31, 2017. Entity 
number E0155832017-8 was assigned to VSI. No officer names were listed. On April 4, 2017, 
White opened three checking accounts in the name of VSI, including Chase Platinum Business 
Checking account ending in 0905, Chase Platinum Business Checking account ending in 3511, 
and Chase Platinum Business Checking account ending in 2125. White had sole signature 
authority on the accounts. The primary business ID number listed on the signature card was 
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E0155832017. Although White did not include the -8 on the signature card, a search of Nevada 
Secretary of State Corporate Records for entity number E0155832017 listed VSI as the only 
entity assigned that number. 

20. Deposits into the VSI account ending in 0905 from account opening through August 
31, 2018 exceeded $5.9 million. Deposits included a Wells Fargo Rank cashier’s check in the 
amount of $566,292.04 payable to Talon V. White that was purchased by Talon V. White with 
funds in his Wells Fargo Bank account. As stated above, funds deposited into White’s Wells 
Fargo Bank account consisted of subscriptions to the movie websites established by White and 
from transfers from other bank accounts established by White that received proceeds from the 
movie subscription websites. Subsequent deposits into the Chase 0905 account from Stripe have 
been identified as proceeds from subscriptions to the websites described above. Deposits from 
Stripe often exceeded $100,000 per deposit. 

21. Withdrawals from the Chase 0905 account include over $1 million used to purchase 
cryptocurrency through Coinbase, a virtual currency exchange. Transfers to Coinbase often 
exceeded $10,000 per transaction. For example, on August 21, 2018, $25,000 was transferred 
from account 0905 to Coinbase for the purchase of cryptocurrency. 

22. The balance in the VSI account ending in 3511 on November 12, 2018, was 
$1,266,650.00. Deposits consisted of transfers from the VSI account 0905 described above. 
Between October 2017 and August 2018, White transferred approximately $1,277,000 from the 
0905 account to the 3511 account. 

23. The balance in the VSI account ending in 2125 on November 12, 2018, was 
$1,383.68. Deposits into the account included deposits from PayPal. The only known source of 
PayPal deposits into White’s bank accounts was from the movie subscription websites. 
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24. On March 31, 2017, White opened Chase Premier Platinum Checking account ending 
in 8881. White had sole signature authority on the account. On the day the account was opened, 
White deposited a Wells Fargo Bank cashier’s check in the amount of $419,367.52 payable to 
Talon V. White that was purchased by Talon V. White with funds in his Wells Fargo Bank 
account. As stated above, funds deposited into White’s Wells Fargo Bank account consisted of 
subscriptions to the movie websites established by White and from transfers from other bank 
accounts established by White that received proceeds from the movie subscription websites. The 
balance in the 8881 account on November 12, 2018, was $200,653.71. 

Purchase of Cryptocurrency 

25. A further review of the Viral Sensations JP Morgan Chase Account 0905 revealed 
that beginning on or around June 2017, there were numerous electronic withdrawals made to 
Coinbase Inc., a virtual currency exchange based in San Francisco, California. The JP Morgan 
Chase Account 0905 was linked to White’s Stripe account that received subscription payments 
from the websites selling unlawful subscriptions to copyrighted material. 

26. White opened a Coinbase account ending in 749cl 12 on May 24, 2017 with 
subscriber listed as Talon White, at his known address in Newport, Oregon and email of 
heyitstalon@hotmail.com. From May 25, 2017 through August 2018, White’s Coinbase account 
received approximately 120 ACH deposits from his Chase 0905 account totaling $384,555.10. 
The last ACH deposit into this account was on December 9, 2017. Coinbase showed that White 
purchased Bitcoin, Bitcoin cash, Litecoin, and Ethereum cryptocurrencies with the ACH 
deposits. 

27. Further review of White’s Coinbase account history reveals that White purchased 
78.93162817 BTC. White’s Coinbase account also purchased Bitcoin Cash in the amount of 


Declaration of Keith Druffel 


EXHIBIT A PAGE 9 



Case 6:19-cv-00707-BR Document 1-1 Filed 05/06/19 Page 10 of 12 


5.74017141 (equivalent to $3,134.33), Litecoin of at least 1210.347482 (equivalent to 
$72,899.23), and 1022.390668 ETH (Ethereum) from Coinbase. This cryptocurrency was 
purchased with funds from one of the bank accounts discussed above or through the exchange of 
other cryptocurrency. 

Search and Seizure Warrants 

28. On November 13, 2018, Mustafa Kasubhai, United States Magistrate Judge for the 
District of Oregon, approved a search and seizure warrant allowing the search of Talon White’s 
residence and seizure up to the following amounts in the accounts subject to forfeiture in this 
affidavit: 

a. Up to $5,900,000.00 contained in Chase Platinum Business Checking account 
ending in 0905 in the name of Viral Sensations Inc. 

b. Up to $1,420,223.00 contained in Chase Platinum Business Checking account 
ending in 3511 in the name of Viral Sensations Inc. 

c. Up to $90,000 contained in Chase Platinum Business Checking account ending in 
2125 in the name of Viral Sensations Inc. 

d. Up to $419,367.52 contained in Chase Premier Platinum Checking account 
ending in 8881 in the name of Talon V. White. 

e. Up to $8,029,933.72 contained in White’s Stripe account. 

f. Up to 78.93162817 Bitcoin from Talon White’s Coinbase account 

g. Up to 5.74017141 Bitcoin Cash from Talon White’s Coinbase account. 

h. Up to 1022.390668 Ethereum, from Talon White’s Coinbase account. 
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29. On November 15, 2018, the search warrant was executed at Talon White’s residence 
in Newport, Oregon. During the search, agents located $1,521 in White’s wallet, $5,200 in a 
nightstand, and $26,200 in a safe, for a total seizure of $32,921 in U.S. Currency. 

30. On November 15, 2018, the seizure warrants were served on the various accounts and 
the amounts seized from each account, which are listed in paragraph 3, are the amounts that the 
subject to forfeiture in this civil complaint. 

CONCLUSION 

31. Based on the above, I have probable cause to believe, and I do believe, that White and 
others known and unknown were involved in a conspiracy to commit copyright infringement and 
money laundering, in violation of 18 U.S.C. §§ 1957 and 2319 from at least 2013 through 
November 2018. 

32.1 believe that proceeds from the copyright infringement were deposited, either 
directly or indirectly, into JP Morgan Chase Bank accounts under the sole signature authority of 
White, and that all funds in VSI Chase Perfonnance Business Checking account ending in 0905, 
VSI Chase Platinum Business Checking account ending in 3511, Chase Platinum Business 
Checking account ending in 2125 and White Chase Premier Platinum Checking account ending 
in 8881, the cryptocurrency accounts and the currency seized from his house are proceeds from 
criminal copyright infringement, and, as such, are subject to forfeiture pursuant to pursuant to 18 
U.S.C. § 2323 and 18 U.S.C. § 981(a)(1)(C). 
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33. In addition, because White used over $10,000 to purchase certain cryptocurrency, 
those accounts are property involved in a transaction in violation of 18 U.S.C. § 1957 (Money 
Laundering), and, as such, are subject to forfeiture pursuant to 18 U.S.C. § 981(a)(1)(A). 

I declare under penalty of perjury that the foregoing is true and correct pursuant to 
28 U.S.C. §1746. 

Executed this 6th day of May, 2019. 



Keith Druffel 
Special Agent 


IRS-CI 
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□ 

875 Customer Challenge 
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□ 
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□ 
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□ 
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□ 

730 Labor/Mgmt.Reporting 

□ 864 SSID Title XVI 

□ 

890 Other Statutory Actions 

□ 196 Franchise 
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□ 865 RSI (405(g)) 

□ 
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CIVIL RIGHTS 
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□ 

740 Railway Labor Act 

FEDERAL TAX SUITS 

□ 

892 Economic Stabilization Act 

□ 210 Land Condemnation 

□ 

441 Voting 

□ 

510 Motions to Vacate 

a 

790 Other Labor Litigation 

□ 870 Taxes (U.S. Plaintiff 

□ 

893 Environmental Matters 

□ 220 Foreclosure 

□ 

442 Employment 


Sentence 

a 

791 Empl. Ret. Inc. 

or Defendant) 

□ 

894 Energy Allocation Act 

□ 230 Rent Lease & Ejectment 

□ 

443 Housing/ 


Habeas Corpus: 


Security Act 

□ 871 IRS—Third Party 

□ 

895 Freedom of Information 

□ 240 Torts to Land 


Accommodations 

□ 

530 General 



26 USC 7609 


Act 

□ 245 Tort Product Liability 

□ 

444 Welfare 

□ 

535 Death Penalty 

IMMIGRATION 


□ 

900Appeal of Fee Determination 

□ 290 All Other Real Property 

□ 

445 Amer. w/Disabilities - 

□ 

540 Mandamus & Other 

□ 

462 Naturalization Application 



Under Equal Access 



Employment 

□ 

550 Civil Rights 

□ 

463 Habeas Corpus - 



to Justice 


□ 

446 Amer. w/Disabilities - 

□ 
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Alien Detainee 


□ 

950 Constitutionality of 



Other 



□ 

465 Other Immigration 



State Statutes 


□ 

440 Other Civil Rights 




Actions 





V. ORIGIN (Place an “X” in One Box Only) 

□ 1 Original □ 2 Removed from □ 3 Remanded from 
Proceeding State Court Appellate Court 


□ 4 Reinstated or □ 5 
Reopened 


Transferred from 
another district 
(specify) 


□ 6 Multidistrict 
Litigation 


□ 7 


Appeal to District 
Judge from 
Magistrate 
Judgment 


VI. CAUSE OF ACTION 


Cite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity): 

18:981 


Brief description of cause: 

forfeiture of assorted funds as proceeds of copyright infringement and involved in money laundering 


VII. REQUESTED IN 
COMPLAINT: 


□ CHECK IF THIS IS A CLASS ACTION 
UNDER F.R.C.P. 23 


DEMAND $ 


CHECK YES only if demanded in complaint: 
JURY DEMAND: □ Yes □ No 
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(See instructions): 
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